CVE-2022-41323

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post2+tuxcare.

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.post1+tuxcare.

Internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression. (CVE-2022-41323) Potential denial-of-service via Accept-Language headers (CVE-2023-23969)

This update for python-Django fixes the following issues:

• CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs (boo#1203793)

• CVE-2022-36359: Fixed a potential reflected file download vulnerability in FileResponse (boo#1201923)

• Update from 2.2.12 to 2.2.28 (boo#1198297)

  • Many CVEs fixes (check https://github.com/django/django/blob/main/docs/releases/)

  2.2.28:

  • CVE-2022-28346: Fixed potential SQL injection in QuerySet.annotate(), aggregate(), and extra() (bsc#1198398)
  • CVE-2022-28347: Fixed potential SQL injection via QuerySet.explain(**options) (bsc#1198399)

  2.2.27:

  • CVE-2022-22818: Fixed possible XSS via {% debug %} template tag (bsc#1195086)
  • CVE-2022-23833: Fixed denial-of-service possibility in file uploads (bsc#1195088)

  2.2.26:

  • CVE-2021-45115: Denial-of-service possibility in UserAttributeSimilarityValidator (bsc#1194115)
  • CVE-2021-45116: Potential information disclosure in dictsort template filter (bsc#1194117)
  • CVE-2021-45452: Potential directory-traversal via Storage.save() (bsc#)

  2.2.25:

  • CVE-2021-44420: Potential bypass of an upstream access control based on URL paths (bsc#1193240)

  2.2.24:

  • CVE-2021-33203: Potential directory traversal via admindocs
  • CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

  2.2.23:

  • regression fix

  2.2.22:

  • CVE-2021-32052: Header injection possibility since URLValidator accepted newlines in input on Python 3.9.5+

This update for python-Django fixes the following issues:

• CVE-2023-23969: Fixed potential denial-of-service via Accept-Language headers (boo#1207565)
• CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs (boo#1203793)

This update for python-Django fixes the following issues:

• CVE-2023-36053: Fixed potential regular expression denial of service vulnerability in EmailValidator/URLValidator (boo#1212742)
• CVE-2023-24580: Fixed potential denial-of-service vulnerability in file uploads (boo#1208082)
• CVE-2023-23969: Fixed potential denial-of-service via Accept-Language headers (boo#1207565)
• CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs (boo#1203793)

These are all security issues fixed in the python310-Django-4.1.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-Django-5.1.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• CVE-2022-1471 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 candlepin and puppetserver: various flaws
• CVE-2022-22577 tfm-rubygem-actionpack: rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack
• CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
• CVE-2022-23515 rubygem-loofah: rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting
• CVE-2022-23516 rubygem-loofah: Uncontrolled Recursion leading to denial of service
• CVE-2022-23517 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service
• CVE-2022-23518 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting
• CVE-2022-23519 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
• CVE-2022-23520 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
• CVE-2022-27777 tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers
• CVE-2022-31163 rubygem-tzinfo: rubygem-tzinfo: arbitrary code execution
• CVE-2022-32224 tfm-rubygem-activerecord: activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
• CVE-2022-33980 candlepin: apache-commons-configuration2: Apache Commons Configuration insecure interpolation defaults
• CVE-2022-41323 satellite-capsule:el8/python-django: Potential denial-of-service vulnerability in internationalized URLs
• CVE-2022-41946 candlepin: postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions
• CVE-2022-42003 CVE-2022-42004 candlepin: various flaws
• CVE-2022-42889 candlepin: apache-commons-text: variable interpolation RCE
• CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
• CVE-2023-23969 python-django: Potential denial-of-service via Accept-Language headers
• CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

The items above are not a complete list of changes. This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document.

Benjamin Balder Bach discovered that Django incorrectly handled certain internationalized URLs. A remote attacker could possibly use this issue to cause Django to crash, resulting in a denial of service.